@m2canvas/connect 0.5.0 → 0.7.0

package/dist/bridge/update-io.js

@@ -0,0 +1,118 @@
+/**
+ * `bridge --check-update` 的真实 IO 与命令入口（change acp-bridge-one-time-install D20、R7）。更新的判断都在 update.ts，这里只做外部调用：
+ * - 读清单、下载：一律 `/usr/bin/curl`。安装脚本也用 curl，两边代理行为相同 —— curl 读 HTTPS_PROXY / ALL_PROXY / NO_PROXY 与
+ *   `~/.curlrc`，Node 的 fetch 默认不读代理变量。`-f`：HTTP 错误码当失败，不把错误页写成「下载好的文件」。
+ * - 解压：`/usr/bin/tar`（macOS 的 bsdtar 自带 xz；内容已按清单哈希校验过）。
+ * - 冒烟：用新版本自己的 Node 跑新版本的 `cli.js bridge --self-test`。
+ * 子进程环境由调用方给：生产用 env.ts 的白名单（代理与证书变量都在里面），不把宿主注入的变量带给 curl。
+ *
+ * 不提供清单地址、下载地址的覆盖参数或环境变量（design R8）：测试经 UpdateDeps 注入，或直接对本模块的原语传本机地址。
+ */
+import { appendFileSync, chmodSync, existsSync, mkdirSync, renameSync, rmSync, statSync } from 'node:fs';
+import { home } from '../system.js';
+import { buildAgentEnv } from './env.js';
+import { combinedOutput, execCommand } from './exec.js';
+import { installLayout } from './install-layout.js';
+import { tail } from './precheck-parse.js';
+import { checkForUpdate } from './update.js';
+const CURL = '/usr/bin/curl';
+const TAR = '/usr/bin/tar';
+/** 单个文件的下载上限：Node 包约 27MB，慢网（约 100KB/s）也要下得完 */
+const DOWNLOAD_TIMEOUT_MS = 10 * 60 * 1000;
+const EXTRACT_TIMEOUT_MS = 2 * 60 * 1000;
+/** 冒烟时限（D20 ④） */
+const SELF_TEST_TIMEOUT_MS = 20_000;
+/** update.log 超过这个大小先轮转成 `.1`（每次启动只写几行，很少触发） */
+const UPDATE_LOG_MAX_BYTES = 1024 * 1024;
+function failure(what, result) {
+    const reason = result.timedOut ? 'timed out' : result.code === null ? (result.error ?? 'did not start') : `exited ${result.code}`;
+    const output = tail(combinedOutput(result).trim());
+    return new Error(`${what} ${reason}${output ? `: ${output}` : ''}`);
+}
+export function createUpdateIO(options) {
+    const { exec, env } = options;
+    return {
+        async fetchText(url, timeoutMs) {
+            const seconds = String(Math.max(1, Math.ceil(timeoutMs / 1000)));
+            const result = await exec(CURL, ['-fsSL', '--connect-timeout', '5', '--max-time', seconds, url], { env, timeoutMs: timeoutMs + 2_000, maxOutput: 256 * 1024 });
+            if (result.code !== 0)
+                throw failure('curl', result);
+            return result.stdout;
+        },
+        async download(url, dest) {
+            const seconds = String(DOWNLOAD_TIMEOUT_MS / 1000);
+            // 低于 10KB/s 持续 30 秒就放弃、换下一个源：官方源只有涓流速度时不能拖到总时限（review r1 R1-S4，与安装脚本相同）
+            const result = await exec(CURL, ['-fsSL', '--connect-timeout', '10', '--speed-limit', '10240', '--speed-time', '30', '--max-time', seconds, '-o', dest, url], {
+                env,
+                timeoutMs: DOWNLOAD_TIMEOUT_MS + 5_000,
+                maxOutput: 16 * 1024,
+            });
+            if (result.code !== 0) {
+                // curl 失败时可能留下半截或空文件：删掉，免得被当成下载好的内容
+                rmSync(dest, { force: true });
+                throw failure('curl', result);
+            }
+        },
+        async extract(archive, dir) {
+            const result = await exec(TAR, ['-xf', archive, '-C', dir], { env, timeoutMs: EXTRACT_TIMEOUT_MS, maxOutput: 16 * 1024 });
+            if (result.code !== 0)
+                throw failure('tar', result);
+        },
+        async selfTest(nodePath, cliPath) {
+            const result = await exec(nodePath, [cliPath, 'bridge', '--self-test'], { env, timeoutMs: SELF_TEST_TIMEOUT_MS, maxOutput: 16 * 1024 });
+            return { ok: result.code === 0, output: result.timedOut ? `self-test timed out after ${SELF_TEST_TIMEOUT_MS / 1000}s` : combinedOutput(result) };
+        },
+    };
+}
+/** 追加一行到 `logs/update.log`（目录 0700、文件 0600，与 bridge.log 相同）；超过上限先轮转 */
+export function appendUpdateLog(layout, line, maxBytes = UPDATE_LOG_MAX_BYTES) {
+    mkdirSync(layout.logs, { recursive: true, mode: 0o700 });
+    chmodSync(layout.logs, 0o700);
+    if (existsSync(layout.updateLog) && statSync(layout.updateLog).size > maxBytes)
+        renameSync(layout.updateLog, `${layout.updateLog}.1`);
+    appendFileSync(layout.updateLog, `${new Date().toISOString()} ${line}\n`, { mode: 0o600 });
+    chmodSync(layout.updateLog, 0o600);
+}
+function describeOutcome(outcome) {
+    switch (outcome.kind) {
+        case 'unsupported':
+            return 'skipped (only macOS is supported)';
+        case 'not_installed':
+            return 'skipped (not installed by the M2 installer)';
+        case 'manifest_failed':
+            return `kept the current version (couldn't read the manifest: ${outcome.reason})`;
+        case 'up_to_date':
+            return `up to date (${outcome.version})`;
+        case 'rejected':
+            return `kept the current version (${outcome.version} failed to start before)`;
+        case 'failed':
+            return `kept the current version (update to ${outcome.version} failed: ${outcome.reason})`;
+        case 'updated':
+            return `updated ${outcome.from} -> ${outcome.to}`;
+    }
+}
+/**
+ * 命令入口（由启动器调用）。日志写进 update.log；标准输出只打一行摘要（启动器把它追加进 bridge.log）。
+ * 退出码只供排障：启动器不论成败都用 current 继续，是否刚切换过版本由它自己比较 current 的前后指向得出。
+ */
+export async function runCheckUpdate() {
+    const layout = installLayout(home);
+    const io = createUpdateIO({ exec: execCommand, env: buildAgentEnv() });
+    const outcome = await checkForUpdate({
+        layout,
+        platform: process.platform,
+        arch: process.arch,
+        ...io,
+        log: (line) => {
+            try {
+                appendUpdateLog(layout, line);
+            }
+            catch {
+                // 日志写不进（磁盘满、权限）不能拦住更新判断；摘要仍会打到标准输出
+            }
+        },
+        now: Date.now,
+    });
+    console.log(`M2 bridge update: ${describeOutcome(outcome)}`);
+    return outcome.kind === 'failed' || outcome.kind === 'manifest_failed' ? 1 : 0;
+}

package/dist/bridge/update.js

@@ -0,0 +1,365 @@
+/**
+ * `bridge --check-update`：启动器每次拉起 bridge 之前调用（change acp-bridge-one-time-install D9 / D13 / D14 / D20）。
+ * 运行它的是**当前版本**的代码；它把新版本下载、校验、冒烟后切成 current，下一步由启动器用新版本拉起。
+ *
+ * 不变量（`connect/local-bridge` 契约 16 delta）：
+ * - 只更新到 m2ui.ai 清单指定的版本（清单版本比当前低也照做，这就是回滚），不跟随 npm latest；
+ * - 清单只给版本与哈希，下载地址由 release-manifest.ts 固定拼出；任何下载内容与清单哈希不符都换下一个源，全部不符就放弃；
+ * - 读清单失败、超时、格式认不出：什么都不改，用当前版本继续；
+ * - 新版本先冒烟（`--self-test`），通过才切换；切换用「先建临时软链再改名」，任何时刻 current 都指向一个完整的版本；
+ * - 「新版本拉起后没起来」的回退不在这里：新版本可能连模块都加载不了，回退判定在很少改动的启动器里（契约 16 delta）；
+ * - 不加清单地址、下载地址的覆盖开关：那会让「只读 m2ui.ai 清单」多出一条旁路（design R8）。测试经 UpdateDeps 注入下载。
+ *
+ * 并发（design N1）：不加锁。所有写入先写临时目录 / 临时软链再改名；两个更新同时跑时各自下到自己的临时目录，
+ * 后完成的发现版本目录已完整就丢掉自己的，发现 current 已经切好就不再切。
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { ADAPTERS, ADAPTER_READY_MARKER, adapterInstallDirName } from './adapters.js';
+import { NODE_PATH_FILE, connectCliPath, connectPackageDir } from './install-layout.js';
+import { readInstanceRecord } from './instance.js';
+import { tail } from './precheck-parse.js';
+import { MANIFEST_URL, connectTarballUrls, isReleaseVersion, nodeDirName, nodeTarballUrls, parseReleaseManifest, wsTarballUrls, } from './release-manifest.js';
+/** 读清单的总时限（不含下载）：读不到就用当前版本继续，不能拖住启动（D20 ①） */
+export const MANIFEST_TIMEOUT_MS = 10_000;
+/** 临时目录超过这个时长就当作被杀掉的更新留下的残留（正在进行的更新不会这么久） */
+const STALE_TEMP_MS = 60 * 60 * 1000;
+const NODE_DIR_RE = /^node-v\d+\.\d+\.\d+-darwin-(arm64|x64)$/;
+class UpdateError extends Error {
+}
+const message = (error) => (error instanceof Error ? error.message : String(error));
+const tempName = (label) => `.tmp-${label}-${process.pid}-${randomBytes(4).toString('hex')}`;
+/** current / previous 软链指向的版本号；软链不在、内容不是版本号时为 null */
+function readVersionLink(path) {
+    try {
+        const target = readlinkSync(path);
+        return isReleaseVersion(target) ? target : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 启动器写入的拉黑名单：每行一个版本号，其他内容忽略 */
+export function readRejected(path) {
+    try {
+        return readFileSync(path, 'utf8')
+            .split('\n')
+            .map((line) => line.trim())
+            .filter(isReleaseVersion);
+    }
+    catch {
+        return [];
+    }
+}
+function readNodePath(versionDir) {
+    try {
+        const value = readFileSync(join(versionDir, NODE_PATH_FILE), 'utf8').trim();
+        return value || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 版本目录是否完整：node-path、connect 的 cli.js、ws 都在 */
+function isCompleteVersion(dir) {
+    return readNodePath(dir) !== null && existsSync(connectCliPath(dir)) && existsSync(join(dir, 'node_modules', 'ws', 'package.json'));
+}
+/** 原子替换软链：先建临时软链再 rename 覆盖 */
+function swapLink(link, target) {
+    const tmp = `${link}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+    symlinkSync(target, tmp);
+    renameSync(tmp, link);
+}
+/** 原子写小文件：先写临时文件再 rename */
+function writeFileAtomic(path, content) {
+    const tmp = `${path}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+    writeFileSync(tmp, content);
+    renameSync(tmp, path);
+}
+function fileHash(algorithm, path) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash(algorithm);
+        createReadStream(path)
+            .on('error', reject)
+            .on('data', (chunk) => hash.update(chunk))
+            .on('end', () => resolve(hash.digest('hex')));
+    });
+}
+/** 依次试各个源（官方在前），下载失败或哈希不符都换下一个；全部不行就删掉 dest 并抛错 */
+async function fetchVerified(deps, urls, algorithm, expected, dest) {
+    const problems = [];
+    for (const url of urls) {
+        try {
+            await deps.download(url, dest);
+        }
+        catch (error) {
+            problems.push(`download ${url} failed: ${message(error)}`);
+            deps.log(problems[problems.length - 1] ?? '');
+            continue;
+        }
+        if ((await fileHash(algorithm, dest)) === expected) {
+            deps.log(`downloaded ${url} (${algorithm} ok)`);
+            return;
+        }
+        problems.push(`${algorithm} mismatch for ${url}`);
+        deps.log(problems[problems.length - 1] ?? '');
+    }
+    rmSync(dest, { force: true });
+    throw new UpdateError(problems.join('; '));
+}
+/** 清单要求的 Node 已在就直接用；否则下载、校验、解到临时目录再改名（D8 / R9） */
+async function ensureNode(deps, manifest, arch) {
+    const name = nodeDirName(manifest.node.version, arch);
+    const nodeDir = join(deps.layout.runtime, name);
+    const nodeBin = join(nodeDir, 'bin', 'node');
+    if (existsSync(nodeBin))
+        return nodeBin;
+    mkdirSync(deps.layout.runtime, { recursive: true });
+    if (existsSync(nodeDir)) {
+        // 残缺的旧目录（上次解到一半被打断）：挪开再装，不然改名会一直失败（review r1 R1-N3）；挪开的由之后的清理删除
+        renameSync(nodeDir, join(deps.layout.runtime, tempName('old-node')));
+        deps.log(`moved an incomplete ${name} aside`);
+    }
+    const tmp = join(deps.layout.runtime, tempName('node'));
+    mkdirSync(tmp);
+    try {
+        const archive = join(tmp, `${name}.tar.xz`);
+        await fetchVerified(deps, nodeTarballUrls(manifest.node.version, arch), 'sha256', manifest.node.sha256[arch], archive);
+        await deps.extract(archive, tmp);
+        if (!existsSync(join(tmp, name, 'bin', 'node')))
+            throw new UpdateError(`${name}.tar.xz has no bin/node`);
+        // 别的更新抢先装好了同一份 Node：用它的
+        if (!existsSync(nodeBin))
+            renameSync(join(tmp, name), nodeDir);
+        deps.log(`installed Node.js ${manifest.node.version} (${arch})`);
+        return nodeBin;
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+/** 解开 npm tarball（顶层目录 `package/`）并改名到 dest */
+async function unpackNpm(deps, archive, workDir, dest) {
+    const unpacked = join(workDir, `${basename(archive)}.d`);
+    mkdirSync(unpacked);
+    await deps.extract(archive, unpacked);
+    if (!existsSync(join(unpacked, 'package', 'package.json')))
+        throw new UpdateError(`${basename(archive)} has no package/package.json`);
+    mkdirSync(dirname(dest), { recursive: true });
+    renameSync(join(unpacked, 'package'), dest);
+    rmSync(unpacked, { recursive: true, force: true });
+    rmSync(archive, { force: true });
+}
+/**
+ * 准备目标版本目录：已完整存在（例如回滚到 previous）就复用，只把 node-path 对齐到清单的 Node；
+ * 否则在 `bridge/.tmp-*` 里组装（connect 与 ws 两个 tarball 就是完整的 bridge，D13），返回临时目录，由调用方冒烟后改名。
+ */
+async function prepareVersion(deps, manifest, nodeBin) {
+    const versionDir = join(deps.layout.bridge, manifest.connect.version);
+    if (isCompleteVersion(versionDir)) {
+        if (readNodePath(versionDir) !== nodeBin)
+            writeFileAtomic(join(versionDir, NODE_PATH_FILE), `${nodeBin}\n`);
+        deps.log(`reusing ${versionDir}`);
+        return { dir: versionDir, fresh: false };
+    }
+    const tmp = join(deps.layout.bridge, tempName(manifest.connect.version));
+    mkdirSync(tmp, { recursive: true });
+    try {
+        const connectArchive = join(tmp, 'connect.tgz');
+        await fetchVerified(deps, connectTarballUrls(manifest.connect.version), 'sha512', manifest.connect.sha512, connectArchive);
+        await unpackNpm(deps, connectArchive, tmp, connectPackageDir(tmp));
+        const wsArchive = join(tmp, 'ws.tgz');
+        await fetchVerified(deps, wsTarballUrls(manifest.ws.version), 'sha512', manifest.ws.sha512, wsArchive);
+        await unpackNpm(deps, wsArchive, tmp, join(tmp, 'node_modules', 'ws'));
+        writeFileSync(join(tmp, NODE_PATH_FILE), `${nodeBin}\n`);
+        return { dir: tmp, fresh: true };
+    }
+    catch (error) {
+        rmSync(tmp, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** 冒烟通过的临时目录改名为版本目录；版本目录在这期间被别的更新装好了就丢掉自己的 */
+function commitVersion(deps, tmp, version) {
+    const versionDir = join(deps.layout.bridge, version);
+    if (isCompleteVersion(versionDir)) {
+        rmSync(tmp, { recursive: true, force: true });
+        return;
+    }
+    if (existsSync(versionDir)) {
+        // 不完整的残留（被杀掉的旧更新）：先挪开再删，保证改名那一刻目标不存在
+        const aside = join(deps.layout.bridge, tempName('old'));
+        renameSync(versionDir, aside);
+        rmSync(aside, { recursive: true, force: true });
+    }
+    renameSync(tmp, versionDir);
+}
+function isStaleTemp(path, now) {
+    try {
+        return now - statSync(path).mtimeMs > STALE_TEMP_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM：进程在，只是不属于当前用户 —— 也算在运行
+        return error.code === 'EPERM';
+    }
+}
+/** 状态文件里还活着的 bridge 的 pid（任意端口、任意版本，含终端里运行的 npx bridge） */
+function runningBridgePid(deps) {
+    const isAlive = deps.isAlive ?? defaultIsAlive;
+    const names = existsSync(deps.layout.root) ? readdirSync(deps.layout.root) : [];
+    for (const name of names) {
+        if (!/^bridge-\d+\.json$/.test(name))
+            continue;
+        const record = readInstanceRecord(join(deps.layout.root, name));
+        if (record && isAlive(record.pid))
+            return record.pid;
+    }
+    return null;
+}
+const listDir = (dir) => (existsSync(dir) ? readdirSync(dir) : []);
+function removePath(deps, path, what) {
+    try {
+        rmSync(path, { recursive: true, force: true });
+        deps.log(`removed ${what}`);
+    }
+    catch (error) {
+        deps.log(`couldn't remove ${what}: ${message(error)}`);
+    }
+}
+/**
+ * 过期的 `bridge/.tmp-*`、`runtime/.tmp-*`：被打断的安装 / 更新留下的半截下载，以及挪开的残缺目录（review r2 R2-N4）。
+ * 每次检查都清（启动器每次启动都会调用），不等版本切换：清单版本不变时它们会一直留着，慢网下每被 agent 打断一次就多一份。
+ * 不受「有 bridge 在运行」的约束：它们不属于任何在用的版本；正在写入的临时目录是新近的（下载一次最多 10 分钟），过不了 1 小时的门槛。
+ */
+function removeStaleTemps(deps) {
+    const now = deps.now();
+    for (const dir of [deps.layout.bridge, deps.layout.runtime]) {
+        for (const name of listDir(dir)) {
+            const path = join(dir, name);
+            if (name.startsWith('.tmp-') && isStaleTemp(path, now))
+                removePath(deps, path, `stale ${name}`);
+        }
+    }
+}
+/**
+ * 只保留两个版本与它们用到的 Node 和适配器目录（D20「清理」、N2）。清理失败只记日志，不影响这次更新的结果。
+ * 有 bridge 在运行时整段跳过（review r1 R1-S3）：它可能是更早的版本（bridge 运行期间启动器被调用、中间跨了两次清单更新），
+ * 它用的 Node、npm 与组件目录都不能删；之后某次启动时没有 bridge 在运行，再清。过期临时目录另由 `removeStaleTemps` 每次清。
+ */
+function cleanup(deps, keep) {
+    const { layout } = deps;
+    const running = runningBridgePid(deps);
+    if (running !== null) {
+        deps.log(`skipped cleanup: an M2 bridge is running (pid ${running})`);
+        return;
+    }
+    const remove = (path, what) => removePath(deps, path, what);
+    for (const name of listDir(layout.bridge)) {
+        if (isReleaseVersion(name) && !keep.includes(name))
+            remove(join(layout.bridge, name), `bridge ${name}`);
+    }
+    const usedNode = new Set(keep.map((version) => readNodePath(join(layout.bridge, version))).flatMap((node) => (node ? [basename(dirname(dirname(node)))] : [])));
+    for (const name of listDir(layout.runtime)) {
+        if (NODE_DIR_RE.test(name) && !usedNode.has(name))
+            remove(join(layout.runtime, name), `runtime ${name}`);
+    }
+    // 适配器目录名由各版本自带的 lockfile 决定；任何一个保留版本的 lockfile 读不出，就整段跳过（宁可多留几百 MB，不能删掉在用的）
+    const keepAdapters = new Set();
+    try {
+        for (const version of keep) {
+            const sourceRoot = join(connectPackageDir(join(layout.bridge, version)), 'adapters');
+            for (const spec of Object.values(ADAPTERS))
+                keepAdapters.add(adapterInstallDirName(sourceRoot, spec.dir));
+        }
+    }
+    catch (error) {
+        deps.log(`skipped adapter cleanup: ${message(error)}`);
+        return;
+    }
+    const patterns = Object.values(ADAPTERS).map((spec) => new RegExp(`^${spec.dir}-[0-9a-f]{16}$`));
+    for (const name of listDir(layout.adapters)) {
+        if (!patterns.some((pattern) => pattern.test(name)) || keepAdapters.has(name))
+            continue;
+        if (existsSync(join(layout.adapters, name, ADAPTER_READY_MARKER)))
+            remove(join(layout.adapters, name), `adapter ${name}`);
+    }
+}
+export async function checkForUpdate(deps) {
+    const arch = deps.arch === 'arm64' || deps.arch === 'x64' ? deps.arch : null;
+    if (deps.platform !== 'darwin' || !arch)
+        return { kind: 'unsupported' };
+    const installed = readVersionLink(deps.layout.current);
+    if (!installed)
+        return { kind: 'not_installed' };
+    try {
+        removeStaleTemps(deps);
+    }
+    catch (error) {
+        deps.log(`stale temp cleanup stopped early: ${message(error)}`);
+    }
+    let manifest;
+    try {
+        const parsed = parseReleaseManifest(await deps.fetchText(MANIFEST_URL, MANIFEST_TIMEOUT_MS));
+        if (typeof parsed === 'string')
+            throw new UpdateError(parsed);
+        manifest = parsed;
+    }
+    catch (error) {
+        const reason = message(error);
+        deps.log(`manifest unavailable (${reason}); staying on ${installed}`);
+        return { kind: 'manifest_failed', reason };
+    }
+    const target = manifest.connect.version;
+    deps.log(`manifest says ${target}; installed ${installed}`);
+    if (target === installed)
+        return { kind: 'up_to_date', version: target };
+    if (readRejected(deps.layout.rejected).includes(target)) {
+        deps.log(`skipping ${target}: it failed to start before (listed in rejected)`);
+        return { kind: 'rejected', version: target };
+    }
+    try {
+        const nodeBin = await ensureNode(deps, manifest, arch);
+        const candidate = await prepareVersion(deps, manifest, nodeBin);
+        const test = await deps.selfTest(nodeBin, connectCliPath(candidate.dir));
+        if (!test.ok) {
+            if (candidate.fresh)
+                rmSync(candidate.dir, { recursive: true, force: true });
+            throw new UpdateError(`self-test failed: ${tail(test.output.trim())}`);
+        }
+        deps.log(`self-test ok for ${target}`);
+        if (candidate.fresh)
+            commitVersion(deps, candidate.dir, target);
+        const before = readVersionLink(deps.layout.current);
+        if (before === target) {
+            deps.log(`${target} is already current (another update switched it)`);
+            return { kind: 'up_to_date', version: target };
+        }
+        if (before)
+            swapLink(deps.layout.previous, before);
+        swapLink(deps.layout.current, target);
+        deps.log(`switched current ${before ?? '(none)'} -> ${target}`);
+        try {
+            cleanup(deps, before ? [target, before] : [target]);
+        }
+        catch (error) {
+            // 已经切换完成：清理出错只是少删了东西，不能把这次更新报成失败（review r1 R1-N4）
+            deps.log(`cleanup stopped early: ${message(error)}`);
+        }
+        return { kind: 'updated', from: before ?? installed, to: target };
+    }
+    catch (error) {
+        const reason = message(error);
+        deps.log(`update to ${target} failed (${reason}); staying on ${installed}`);
+        return { kind: 'failed', version: target, reason };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m2canvas/connect",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Connect your local agent clients (Claude Code, Codex, Cursor, OpenCode, Qoder) to M2 Canvas over MCP in one command, and run the local bridge that lets M2 drive them over ACP.",
   "type": "module",
   "bin": {