@linxin666/dsh-remote-web-ui 0.1.15 → 0.1.17

package/lib/types/client/settings-form.js

@@ -40,6 +40,15 @@ export function textField(field) {
         },
     };
 }
+/**
+ * A free-text field the Host treats as a secret and redacts from the read-back
+ * (role('secret') in the section schema). The card still edits it like text,
+ * but a save never compares the redacted value back and relies on the scope
+ * reporting the write landed.
+ */
+export function secretField(field) {
+    return { ...textField(field), secret: true };
+}
 /** A boolean field, edited through true/false draft text. */
 export function booleanField(field) {
     return {
@@ -84,6 +93,7 @@ export class CardForm {
     listeners = new Set();
     saving = false;
     failed = false;
+    failedReason;
     /** @param scope - the bound settings scope for this card's namespace. */
     constructor(scope, specs) {
         this.scope = scope;
@@ -108,6 +118,7 @@ export class CardForm {
             invalid: plan.some(item => item.run === undefined),
             saving: this.saving,
             failed: this.failed,
+            ...this.failedReason === undefined ? {} : { failedReason: this.failedReason },
         };
     }
     /** Read one field's state from the effective section and its staged draft. */
@@ -137,37 +148,68 @@ export class CardForm {
                     return;
                 this.staged.clear();
                 this.failed = false;
+                this.failedReason = undefined;
                 this.publish();
             },
         };
     }
     /**
      * Write every staged edit, then re-seed from what the Host accepted.
+     *
+     * When the scope carries the optional batch surface (the dsh-web-ui
+     * bridge scope), every planned write rides one mutation so cross-field
+     * validate hooks (baseURL+model) judge the batch as a unit instead of
+     * deadlocking on per-field writes. Otherwise the per-field loop runs.
+     * A field lands only when the Host reports it held the staged value; a
+     * landed field's draft is dropped, a failed one stays staged for the user.
      * @returns settlement after every write and the read-back.
      */
     async save() {
         const plan = this.plan();
-        const writes = plan.flatMap(item => item.run === undefined ? [] : [item.run]);
-        if (plan.length === 0 || this.saving || writes.length !== plan.length)
+        const valid = plan.filter(item => item.run !== undefined);
+        if (plan.length === 0 || this.saving || valid.length !== plan.length)
             return;
+        const plannedWrites = valid.map(item => item.op);
         // Snapshot the fields this save writes, so edits staged while it is in
         // flight survive: only the staged keys this save actually wrote are cleared.
         const fields = new Set(plan.map(item => item.field));
         this.saving = true;
         this.failed = false;
+        this.failedReason = undefined;
         this.publish();
-        let landed = true;
-        for (const write of writes) {
-            landed = await write() && landed;
+        const landed = new Set();
+        const batch = this.batchedScope();
+        if (batch !== undefined) {
+            const result = await batch.mutate(plannedWrites);
+            if (result.ok) {
+                for (const field of result.fields) {
+                    if (field.landed)
+                        landed.add(field.field);
+                }
+            }
+            else {
+                this.failedReason = result.message;
+            }
+        }
+        else {
+            for (const item of valid) {
+                if (await item.run())
+                    landed.add(item.field);
+            }
         }
-        if (landed) {
-            for (const field of fields)
+        for (const field of fields) {
+            if (landed.has(field))
                 this.staged.delete(field);
         }
         this.saving = false;
-        this.failed = !landed;
+        this.failed = landed.size !== fields.size;
         this.publish();
     }
+    /** The scope's batch surface when it supports one; undefined conservatively otherwise. */
+    batchedScope() {
+        const candidate = this.scope;
+        return typeof candidate?.mutate === 'function' ? candidate : undefined;
+    }
     /**
      * Every staged edit a save would write. An entry whose draft is not a value
      * its field accepts carries no write: the form is still dirty, and the save
@@ -181,18 +223,18 @@ export class CardForm {
             const spec = this.specOf(field);
             if (staged.clear) {
                 if (this.stored(field))
-                    plan.push({ field, run: () => this.clear(field) });
+                    plan.push({ field, op: { field, op: 'unset' }, run: () => this.clear(field) });
                 continue;
             }
             if (staged.text === spec.format(this.sectionValue(field)))
                 continue;
             const write = spec.parse(staged.text);
             if (write === undefined)
-                plan.push({ field, run: undefined });
+                plan.push({ field, op: { field, op: 'unset' }, run: undefined });
             else if (write.kind === 'clear')
-                plan.push({ field, run: () => this.clear(field) });
+                plan.push({ field, op: { field, op: 'unset' }, run: () => this.clear(field) });
             else
-                plan.push({ field, run: () => this.store(field, write.value) });
+                plan.push({ field, op: { field, op: 'set', value: write.value }, run: () => this.store(field, write.value) });
         }
         return plan;
     }
@@ -202,11 +244,18 @@ export class CardForm {
     }
     async store(field, value) {
         await this.scope.set(field, value);
+        // A redacted secret never appears in the user layer read-back; judging it
+        // by value would misreport a successful secret save as failed. The bridge
+        // reports secret writes through its secret-set markers (batch path); on
+        // the per-field path the scope resolved, so the write is landed.
+        if (this.specOf(field).secret)
+            return true;
         return this.userLayer()?.[field] === value;
     }
     stage(field, edit) {
         this.staged.set(field, edit);
         this.failed = false;
+        this.failedReason = undefined;
         this.publish();
     }
     specOf(field) {

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAmB3B,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA4B,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAU3B,CAAA;AAyBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CA0MzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAmB3B,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA4B,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAU3B,CAAA;AAyBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAkOzD"}

package/lib/types/index.js

@@ -18,7 +18,7 @@ import { makeMobileRoutes } from "./mobile-routes.js";
 import { makeMobileApiRoutes } from "./mobile-api.js";
 import { lanIPv4Addresses } from "./lan.js";
 import { TunnelManager } from "./tunnel.js";
-import { checkUpdates, fetchLatestVersion, resolveAnchorManifest, resolveUpdateTarget, runUpdate, } from "./update.js";
+import { checkUpdates, fetchLatestVersion, resolveAnchorManifest, resolveUpdateTarget, runUpdateVerified, } from "./update.js";
 import { makeUpdateRoutes } from "./update-routes.js";
 /** Stable cordis plugin name. */
 export const name = 'remote-web-ui';
@@ -152,19 +152,27 @@ export function apply(ctx, config) {
     }
     // ── remote update ────────────────────────────────────────────────────────
     // The dsh-web-ui self-update surface: probe the npm registry for family
-    // releases and run `pnpm update` in the owning profile. Resolutions anchor
-    // on the host process's own module graph, so the update always targets the
-    // profile the running web GUI was booted from. The probe path resolves once
-    // (the anchor stays the same package across updates); versions are re-read
-    // from disk per check.
+    // releases and run `pnpm update --latest` in the owning profile. Resolutions
+    // anchor on the host process's own module graph, so the update always
+    // targets the profile the running web GUI was booted from. The anchor path
+    // is re-resolved per operation: pnpm removes the old version's .pnpm
+    // directory on update, so a boot-time captured path would fail to read
+    // after a successful update; versions are re-read from disk per check.
     const requireFromHost = createRequire(import.meta.url);
-    const anchorManifestPath = resolveAnchorManifest(specifier => requireFromHost.resolve(specifier));
+    const resolveAnchorPath = () => resolveAnchorManifest(specifier => {
+        try {
+            return requireFromHost.resolve(specifier);
+        }
+        catch {
+            return undefined;
+        }
+    });
     const updateRoutes = makeUpdateRoutes({
         // Control endpoints are host-surface only: a LAN/phone origin must never
         // trigger a real install on this machine.
         fence: request => isTrustedApiRequest(request, []),
         check: () => checkUpdates({
-            anchorManifestPath,
+            anchorManifestPath: resolveAnchorPath(),
             resolve: specifier => {
                 try {
                     return requireFromHost.resolve(specifier);
@@ -176,7 +184,7 @@ export function apply(ctx, config) {
             fetchLatest: name => fetchLatestVersion(name, fetch),
         }),
         run: async () => {
-            const target = resolveUpdateTarget({ anchorManifestPath });
+            const target = resolveUpdateTarget({ anchorManifestPath: resolveAnchorPath() });
             if ('error' in target) {
                 const code = target.error;
                 return {
@@ -187,7 +195,25 @@ export function apply(ctx, config) {
                     errorCode: code,
                 };
             }
-            return runUpdate({ profileDir: target.profileDir, packages: target.packages });
+            // Verify the versions actually moved after a green pnpm exit: the pnpm
+            // 11 minimumReleaseAge gate can silently keep the installed versions
+            // (same-day releases), which a plain exit-0 check would report as
+            // success — the user then restarts and nothing changed.
+            return runUpdateVerified({
+                run: { profileDir: target.profileDir, packages: target.packages },
+                check: {
+                    anchorManifestPath: resolveAnchorPath(),
+                    resolve: specifier => {
+                        try {
+                            return requireFromHost.resolve(specifier);
+                        }
+                        catch {
+                            return undefined;
+                        }
+                    },
+                    fetchLatest: name => fetchLatestVersion(name, fetch),
+                },
+            });
         },
     });
     const routes = [

package/lib/types/mobile-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA4HnE"}
+{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA6InE"}

package/lib/types/mobile-api.js

@@ -77,10 +77,23 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 export function makeMobileApiRoutes(deps) {
     const { service, apiProxy, mobileEnterToSend } = deps;
     const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
+    /**
+     * Refresh the paired device's presence and report whether it is live.
+     * The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
+     * sender, so any activity on the mobile channel — a gated RPC, or the live
+     * SSE stream staying open — must count as presence. Without this, an
+     * idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
+     * wrongly reports it as disconnected.
+     */
+    const touchDeviceFor = (req) => {
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        if (deviceId === undefined)
+            return false;
+        return service.touchDevice(deviceId);
+    };
     /** The phone gate: a live paired-device cookie, or nothing else proceeds. */
     const gateOk = (req) => {
-        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-        return deviceId !== undefined && service.hasDevice(deviceId);
+        return touchDeviceFor(req);
     };
     const writeJson = (res, status, body) => {
         res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
@@ -164,6 +177,10 @@ export function makeMobileApiRoutes(deps) {
         const heartbeat = setInterval(() => {
             if (closed)
                 return;
+            // An open SSE stream proves the phone is still live even while the agent
+            // idles (no RPC traffic), so refresh presence alongside the transport
+            // keepalive — otherwise an idle phone drifts to "disconnected".
+            touchDeviceFor(req);
             try {
                 res.write(': ping\n\n');
             }

package/lib/types/mobile-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAqC/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAqB7C"}
+{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAwD/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAmC7C"}

package/lib/types/mobile-routes.js

@@ -14,6 +14,10 @@ import { fileURLToPath } from 'node:url';
 function mobileBundlePath() {
     return fileURLToPath(new URL('../lib/mobile.js', import.meta.url));
 }
+/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
+function appleTouchIconPath() {
+    return fileURLToPath(new URL('../assets/apple-touch-icon.png', import.meta.url));
+}
 /** The mobile page shell: minimal, offline-safe, no external assets. */
 function pageHtml(bundleUrl) {
     return [
@@ -24,6 +28,10 @@ function pageHtml(bundleUrl) {
         '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
         '<meta name="theme-color" content="#f3f5f9">',
         '<meta name="referrer" content="no-referrer">',
+        // iOS "Add to Home Screen" uses apple-touch-icon for the tile icon;
+        // the PNG ships with the package (opaque background — iOS composites
+        // transparency onto black, so the icon avoids transparent regions).
+        '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
         '<title>移动端远程控制</title>',
         '</head>',
         '<body>',
@@ -42,6 +50,15 @@ function writeStatic(res, status, type, body) {
     });
     res.end(body);
 }
+/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+function writePng(res, status, body) {
+    res.writeHead(status, {
+        'content-type': 'image/png',
+        'cache-control': 'public, max-age=31536000, immutable',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(body);
+}
 /**
  * Build the mobile page routes.
  * @returns the two exact routes to register on webServer.
@@ -64,8 +81,23 @@ export function makeMobileRoutes() {
             writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
         }
     };
+    const handleIcon = async (_req, res) => {
+        const path = appleTouchIconPath();
+        if (!existsSync(path)) {
+            writeStatic(res, 404, 'text/plain', 'apple-touch-icon not found');
+            return;
+        }
+        try {
+            const body = await readFile(path);
+            writePng(res, 200, body);
+        }
+        catch {
+            writeStatic(res, 500, 'text/plain', 'failed to read the apple-touch-icon');
+        }
+    };
     return [
         { kind: 'exact', path: '/m', handler: handlePage },
         { kind: 'exact', path: '/m/mobile.js', handler: handleBundle },
+        { kind: 'exact', path: '/m/apple-touch-icon.png', handler: handleIcon },
     ];
 }

package/lib/types/update.d.ts

@@ -2,7 +2,7 @@
  * Remote update support for the dsh-web-ui family — host half. Detects the
  * installed aggregate package (@linxin666/dsh-web-ui-all) and its family
  * children, probes the npm registry for newer releases, and runs the actual
- * update as `pnpm update` inside the owning dsh profile directory.
+ * update as `pnpm update --latest` inside the owning dsh profile directory.
  *
  * Pure logic with injected seams (manifest reading, registry fetches, process
  * spawning) so the whole surface is unit-testable without touching disk,
@@ -100,11 +100,13 @@ export interface UpdateCheckDeps {
 }
 /**
  * Resolve the anchor package's manifest path. The aggregate package is the
- * canonical entry point; this plugin's own package is the fallback.
+ * canonical entry point; this plugin's own package is the fallback. Both a
+ * throwing resolve and an undefined return mean "not installed" and move on
+ * to the next candidate.
  * @param resolve - a Node resolve implementation scoped to the host process.
  * @returns the absolute manifest path, or undefined when neither is installed.
  */
-export declare function resolveAnchorManifest(resolve: (specifier: string) => string): string | undefined;
+export declare function resolveAnchorManifest(resolve: (specifier: string) => string | undefined): string | undefined;
 /** The resolved update target: the profile pnpm runs in plus the package list. */
 export interface UpdateTarget {
     /** Owning profile name. */
@@ -157,7 +159,11 @@ export type UpdateErrorCode =
 /** The anchor is a local link/dev install pnpm cannot update. */
  | 'link'
 /** pnpm exited non-zero. */
- | 'pnpm-failed';
+ | 'pnpm-failed'
+/** pnpm exited 0 but the installed versions did not move. */
+ | 'stale'
+/** pnpm exited 0 but the post-run version check could not verify the install. */
+ | 'verify-failed';
 /** Result of one update run. */
 export interface UpdateRunResult {
     ok: boolean;
@@ -191,5 +197,41 @@ export interface UpdateRunDeps {
  * @returns the outcome with captured output.
  */
 export declare function runUpdate(deps: UpdateRunDeps): Promise<UpdateRunResult>;
+/** Seam set for the verified update run (run + post-run status check). */
+export interface UpdateRunVerifiedDeps {
+    /** The pnpm run (profile dir + package list). */
+    run: UpdateRunDeps;
+    /** The post-run status check (same seams as checkUpdates). */
+    check: UpdateCheckDeps;
+}
+/**
+ * Run the update, then verify the installed versions actually moved. pnpm
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
+ * installed versions afterwards and surface a `stale` failure (with the
+ * captured pnpm output) when nothing moved, so the panel can tell the user
+ * how to unblock the gate instead of claiming success.
+ *
+ * The stale decision anchors on the pre-run installed versions, not on the
+ * registry latest: under a lenient gate pnpm may move 0.1.12 -> 0.1.13 while
+ * latest stays 0.1.15 — that is a real update, not stale. The post-run anchor
+ * path is re-resolved rather than reused from boot time: pnpm removes the old
+ * version's .pnpm directory on update, so a boot-time captured path would
+ * fail to read and collapse a successful update into a bogus 'missing'.
+ *
+ * A green exit whose verification has nothing to compare (registry probe
+ * outage, missing anchor, non-npm mode) is reported as `verify-failed` — it
+ * must never read as success. A green exit where no package moved but the
+ * post-run check could not prove the install is fully current (a partial
+ * probe failure hides whether a gate kept something back) is also
+ * `verify-failed`: it must not collapse into a success either.
+ * @param deps - the run and check seams.
+ * @returns the run result; `stale` when exit 0 left every version in place,
+ * `verify-failed` when the post-run check could not verify anything.
+ */
+export declare function runUpdateVerified(deps: UpdateRunVerifiedDeps): Promise<UpdateRunResult>;
 export {};
 //# sourceMappingURL=update.d.ts.map

package/lib/types/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,GAAG,SAAS,CASpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAaD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa,CAAA;AAEjB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAYD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAsHvE"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAqBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAuBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CA8HvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}

package/lib/types/update.js

@@ -2,7 +2,7 @@
  * Remote update support for the dsh-web-ui family — host half. Detects the
  * installed aggregate package (@linxin666/dsh-web-ui-all) and its family
  * children, probes the npm registry for newer releases, and runs the actual
- * update as `pnpm update` inside the owning dsh profile directory.
+ * update as `pnpm update --latest` inside the owning dsh profile directory.
  *
  * Pure logic with injected seams (manifest reading, registry fetches, process
  * spawning) so the whole surface is unit-testable without touching disk,
@@ -130,14 +130,18 @@ export function isLinkedSpec(spec) {
 }
 /**
  * Resolve the anchor package's manifest path. The aggregate package is the
- * canonical entry point; this plugin's own package is the fallback.
+ * canonical entry point; this plugin's own package is the fallback. Both a
+ * throwing resolve and an undefined return mean "not installed" and move on
+ * to the next candidate.
  * @param resolve - a Node resolve implementation scoped to the host process.
  * @returns the absolute manifest path, or undefined when neither is installed.
  */
 export function resolveAnchorManifest(resolve) {
     for (const name of [AGGREGATE_PACKAGE, SELF_PACKAGE]) {
         try {
-            return resolve(name + '/package.json');
+            const path = resolve(name + '/package.json');
+            if (path !== undefined)
+                return path;
         }
         catch {
             // Not installed — try the next candidate.
@@ -216,15 +220,22 @@ export async function fetchLatestVersion(name, fetchImpl, timeoutMs = 10_000) {
         return undefined;
     }
 }
+/**
+ * Sentinel for an installed version that could not be read (missing manifest
+ * or resolve failure). It is a real-looking version so `checkUpdates` can
+ * render the affected row, but the verified-update comparison must never
+ * treat it as evidence — a read failure is not a version that "moved".
+ */
+const VERSION_UNKNOWN = '0.0.0';
 /** The resolved current version of one family package (probe failure tolerated). */
 function readInstalledVersion(resolve, name) {
     try {
         const path = resolve(name + '/package.json');
         const version = path === undefined ? undefined : readManifest(path)?.version;
-        return typeof version === 'string' ? version : '0.0.0';
+        return typeof version === 'string' ? version : VERSION_UNKNOWN;
     }
     catch {
-        return '0.0.0';
+        return VERSION_UNKNOWN;
     }
 }
 /**
@@ -291,6 +302,16 @@ const OUTPUT_CAP = 16 * 1024;
  * detects this message instead of the spawn error event.
  */
 const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
+/**
+ * Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
+ * silently skips same-day releases — `pnpm update --latest` then exits 0
+ * without moving anything and the post-run verification would misreport a
+ * stale no-op. The update here is explicitly user-initiated and the panel
+ * shows exactly which versions are being installed, so the gate only adds a
+ * confusing silent no-op; override it per-invocation instead of asking every
+ * user to edit the profile's pnpm-workspace.yaml.
+ */
+const MIN_RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0';
 /**
  * Run the update inside the profile directory. Tries pnpm first, falls back
  * to corepack and then npx when the previous command is missing (ENOENT);
@@ -313,10 +334,18 @@ export function runUpdate(deps) {
         };
         // Ordered fallback chain: each is tried only when the previous one is
         // missing on PATH (ENOENT on the spawn error event, never on close).
+        // `--latest` is required: dsh plugin writes exact-version specs (e.g.
+        // "0.1.12" without a range), and plain `pnpm update` treats an exact spec
+        // as pinned — it prints "Already up to date" and exits 0 without moving
+        // the installed version, so the panel would report a false success.
+        // `MIN_RELEASE_AGE_OVERRIDE` rides along every candidate: without it the
+        // pnpm 11 minimumReleaseAge gate (default 24 h) silently keeps same-day
+        // releases in place, which the post-run verification would then have to
+        // surface as `stale` even though the update is legitimate.
         const candidates = [
-            { command: 'pnpm', args: ['update', ...packages] },
-            { command: 'corepack', args: ['pnpm', 'update', ...packages] },
-            { command: 'npx', args: ['--yes', 'pnpm', 'update', ...packages] },
+            { command: 'pnpm', args: ['update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+            { command: 'corepack', args: ['pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+            { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
         ];
         // `output` accumulates across candidates for UI display; `currentOutput`
         // is reset per candidate and carries only that candidate's own diagnostics
@@ -427,3 +456,100 @@ export function runUpdate(deps) {
         runCandidate(0);
     });
 }
+/**
+ * Run the update, then verify the installed versions actually moved. pnpm
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
+ * installed versions afterwards and surface a `stale` failure (with the
+ * captured pnpm output) when nothing moved, so the panel can tell the user
+ * how to unblock the gate instead of claiming success.
+ *
+ * The stale decision anchors on the pre-run installed versions, not on the
+ * registry latest: under a lenient gate pnpm may move 0.1.12 -> 0.1.13 while
+ * latest stays 0.1.15 — that is a real update, not stale. The post-run anchor
+ * path is re-resolved rather than reused from boot time: pnpm removes the old
+ * version's .pnpm directory on update, so a boot-time captured path would
+ * fail to read and collapse a successful update into a bogus 'missing'.
+ *
+ * A green exit whose verification has nothing to compare (registry probe
+ * outage, missing anchor, non-npm mode) is reported as `verify-failed` — it
+ * must never read as success. A green exit where no package moved but the
+ * post-run check could not prove the install is fully current (a partial
+ * probe failure hides whether a gate kept something back) is also
+ * `verify-failed`: it must not collapse into a success either.
+ * @param deps - the run and check seams.
+ * @returns the run result; `stale` when exit 0 left every version in place,
+ * `verify-failed` when the post-run check could not verify anything.
+ */
+export async function runUpdateVerified(deps) {
+    // Pre-run snapshot: the installed versions the update starts from. Only
+    // successfully-read versions are recorded — a read failure (VERSION_UNKNOWN)
+    // is not a baseline and must not look like a version that "moved", or a
+    // green exit that left everything in place could be mistaken for success.
+    const before = new Map();
+    for (const name of deps.run.packages) {
+        const version = readInstalledVersion(deps.check.resolve, name);
+        if (version !== VERSION_UNKNOWN)
+            before.set(name, version);
+    }
+    const result = await runUpdate(deps.run);
+    if (!result.ok)
+        return result;
+    // Re-resolve the anchor after the run: pnpm removes the old version's
+    // .pnpm directory, so a boot-time captured path no longer reads. Fall back
+    // to the provided path only when nothing resolves now.
+    const anchorManifestPath = resolveAnchorManifest(deps.check.resolve) ?? deps.check.anchorManifestPath;
+    const status = await checkUpdates({ ...deps.check, anchorManifestPath });
+    // A green exit with no comparable result is not a success: registry probe
+    // outage, missing anchor, or a non-npm install mode all mean the post-run
+    // check could not verify anything.
+    if (status.error !== undefined || status.mode !== 'npm') {
+        return {
+            ...result,
+            ok: false,
+            errorCode: 'verify-failed',
+            error: 'pnpm exited 0 but the post-run version check could not verify the install',
+        };
+    }
+    // A package "moved" only when a known pre-run version differs from a known
+    // post-run version. A read failure on either side (VERSION_UNKNOWN) is not
+    // evidence of movement and must not turn a no-op update into a success; a
+    // package without a pre-run baseline is ignored — only the packages pnpm
+    // was told to update count as evidence.
+    const moved = status.packages.some(packageStatus => {
+        const beforeVersion = before.get(packageStatus.name);
+        if (beforeVersion === undefined || packageStatus.current === VERSION_UNKNOWN)
+            return false;
+        return packageStatus.current !== beforeVersion;
+    });
+    if (moved)
+        return result;
+    // Nothing moved. A green exit is only a true no-op when the post-run check
+    // proves the install is already current: every probe succeeded and nothing
+    // is outdated. If a probe failed we cannot tell "already up to date" from
+    // "a gate silently kept it back", so report verify-failed rather than a
+    // false success.
+    if (status.outdated) {
+        // stale: the check ran, a newer release exists, and no package moved
+        // (e.g. the minimumReleaseAge gate kept everything in place).
+        return {
+            ...result,
+            ok: false,
+            errorCode: 'stale',
+            error: 'pnpm exited 0 but the installed versions did not change',
+        };
+    }
+    const unverifiable = status.packages.some(packageStatus => packageStatus.latest === undefined);
+    if (unverifiable) {
+        return {
+            ...result,
+            ok: false,
+            errorCode: 'verify-failed',
+            error: 'pnpm exited 0 but the post-run version check could not verify the install',
+        };
+    }
+    return result;
+}